Antivirus scan for 69f448e4edeacd9bd519feed16938a8082c605899b4eaefc7f3494553a2662a2 at 2013-05-16 15:26:33 UTC

Antivirus	Result	Update
AVG	Win32/Cryptor	20130516
Yandex	Backdoor.Pushdo!feG0QLb/a3E	20130516
AntiVir	TR/Dropper.Gen	20130516
Avast	Win32:Malware-gen	20130516
BitDefender	Gen:Variant.Kazy.172451	20130516
Comodo	UnclassifiedMalware	20130516
DrWeb	BackDoor.Bulknet.893	20130516
ESET-NOD32	Win32/Wigon.PH	20130516
Emsisoft	Trojan.Win32.Wigon.AMN (A)	20130516
F-Secure	Gen:Variant.Kazy.172451	20130516
Fortinet	W32/Pushdo.PH!tr.bdr	20130516
GData	Gen:Variant.Kazy.172451	20130516
Ikarus	Virus.Win32.Cryptor	20130516
Kaspersky	Backdoor.Win32.Pushdo.qbz	20130516
Kingsoft	Win32.Hack.Pushdo.q.(kcloud)	20130506
Malwarebytes	Trojan.Agent.RRE	20130516
McAfee	Cutwail-FBVJ!6C5A8C0AF08B	20130516
McAfee-GW-Edition	Cutwail-FBVJ!6C5A8C0AF08B	20130516
eScan	Gen:Variant.Kazy.172451	20130516
Norman	Suspicious_Gen4.DVYCO	20130516
PCTools	Malware.Pilleuz!rem	20130516
Panda	Trj/Genetic.gen	20130516
Symantec	W32.Pilleuz	20130516
TheHacker	Trojan/Wigon.ph	20130516
TrendMicro	TROJ_GEN.RCBB1EA	20130516
TrendMicro-HouseCall	TROJ_GEN.RCBB1EA	20130516
VIPRE	Trojan.Win32.Generic!BT	20130516
nProtect	Backdoor/W32.Pushdo.37888.E	20130516
AhnLab-V3		20130516
Antiy-AVL		20130516
ByteHero		20130513
CAT-QuickHeal		20130516
ClamAV		20130516
Commtouch		20130516
F-Prot		20130516
Jiangmin		20130516
K7AntiVirus		20130515
K7GW		20130515
Microsoft		20130516
NANO-Antivirus		20130516
SUPERAntiSpyware		20130516
Sophos		20130516
TotalDefense		20130516
VBA32		20130515
ViRobot		20130516
eSafe		20130513

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2007-09-06 23:43:57

Entry Point 0x00001235

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 926 1024 5.89 29d50fbe8de882907173da9075dbdc95

.rdata 8192 258 512 2.15 07d568212be49b4b824c63392e713d17

.data 12288 12 512 0.00 bf619eac0cdf3f68d496ea9344137e8b

.rsrc 16384 34384 34816 7.79 5f149009c37b54ef16b755f63a434e6e

PE imports

[+] gdi32.dll

[+] kernel32.dll

[+] user32.dll

Number of PE resources by type

RT_DIALOG 2

RT_BITMAP 1

RT_VERSION 1

Number of PE resources by language

ENGLISH US 4

PE resources

12531bbd720e4f7b01a0721fa080b57a12cdcc429140b3fbe99b2f20c4390f86 data

1618b810818fa186b0cf5d2b280484f63c6d2feb1988627392d2a992c4f864b4 data

b1d60f23e2d7b012a0e90a9f6816508a33215f02aba03402827d9d7c420ee0f7 data

cdffcc47b609bd6856d66dde55f0767be6c62bf3fb202401d265630793a11fcb data

ExifTool file metadata

SubsystemVersion

4.0

LinkerVersion

5.12

ImageVersion

0.0

FileSubtype

FileVersionNumber

1.0.0.0

UninitializedDataSize

LanguageCode

English (U.S.)

FileFlagsMask

0x003f

CharacterSet

Unicode

InitializedDataSize

35840

EntryPoint

0x1235

OriginalFileName

immsim++

MIMEType

application/octet-stream

LegalCopyright

FileVersion

1, 0, 0, 0

TimeStamp

2007:09:07 00:43:57+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

immsim++

ProductVersion

1, 0, 0, 0

FileDescription

Immune System Simulator

OSVersion

4.0

FileOS

Win32

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

CompanyName

Steven Kleinstein

CodeSize

1024

ProductName

IMMSIM++

ProductVersionNumber

1.0.0.0

FileTypeExtension

exe

ObjectFileType

Executable application

File identification

MD5 6c5a8c0af08b69ef2206324a0a5fe35a

SHA1 f34272192c4ed4ea5b9efd24fa2711107e8b3fd0

SHA256 69f448e4edeacd9bd519feed16938a8082c605899b4eaefc7f3494553a2662a2

ssdeep

768:OOazPrS1arJn6NBTIzEGM9nCOsyJzkpF51nx2Dp:9azPrTRUUxM9nCLcD

authentihash 1ba09bedf819bb5613d666c81a0da559988d20466474c68cbf183e3e685f358b

imphash 807a83b8e0d7e300c38dea7594cb2956

File size 37.0 KB ( 37888 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (38.4%) Win32 Executable (generic) (26.3%) Clipper DOS Executable (11.7%) Generic Win/DOS Executable (11.6%) DOS Executable Generic (11.6%)

VirusTotal metadata

First submission 2013-05-09 16:15:30 UTC ( 3 years, 4 months ago )

Last submission 2015-06-12 10:53:02 UTC ( 1 year, 3 months ago )

File names

6c5a8c0af08b69ef2206324a0a5fe35a
005506240
wukonakigdop.exe.vir
6c5a8c0af08b69ef2206324a0a5fe35a
vti-rescan
wukonakigdop.exe
exp3A3.tmp.exe

Advanced heuristic and reputation engines

F-Secure Deepguard Suspicious:W32/Malware!Gemini

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

\\.\Ip (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\69f448e4edeacd9bd519feed16938a8082c605899b4eaefc7f3494553a2662a2 (successful)

Read files

C:\WINDOWS\Registration\R000000000007.clb (successful)

Copied files

SRC: C:\69f448e4edeacd9bd519feed16938a8082c605899b4eaefc7f3494553a2662a2
DST: C:\Documents and Settings\<USER>\wukonakigdop.exe (successful)

Set keys

KEY: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\AppManagement
TYPE: REG_BINARY
VALUE: (successful)

KEY: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\wukonakigdopzap
TYPE: REG_BINARY
VALUE: (successful)

KEY: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\wukonakigdop
TYPE: REG_SZ
VALUE: C:\Documents and Settings\<USER>\wukonakigdop.exe (successful)

Created mutexes

wukonakigdop (successful)

Runtime DLLs

kernel32.dll (successful)

clbcatq.dll (successful)

c:\windows\system32\mswsock.dll (successful)

hnetcfg.dll (successful)

rpcrt4.dll (successful)

c:\windows\system32\wshtcpip.dll (successful)

dnsapi.dll (successful)

c:\windows\system32\winrnr.dll (successful)

rasadhlp.dll (successful)

Additional details

The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.

DNS requests

smtp.live.com (65.55.162.200)

UDP communications

<MACHINE_DNS_SERVER>:53

64.4.10.33:123

SHA256:	69f448e4edeacd9bd519feed16938a8082c605899b4eaefc7f3494553a2662a2
File name:	wukonakigdop.exe.vir
Detection ratio:	28 / 46
Analysis date:	2013-05-16 15:26:33 UTC ( 3 years, 4 months ago ) View latest

Ciphered bundle